Finding common ground between usability and security starts with open dialogue and a shared goal: protecting data without disrupting productivity. Engage both teams to understand their concerns and identify pain points. Implement user-friendly security measures like single sign-on (SSO) and adaptive multi-factor authentication (MFA) to enhance protection while minimizing friction. Leverage risk-based access controls that adjust security based on context, reducing unnecessary restrictions. Conduct regular testing and feedback sessions to refine security protocols without sacrificing efficiency. By fostering collaboration and balancing priorities, you create a secure yet seamless experience for all users.

To find common ground, you need to first conduct meetings with them. This is to give them a chance to speak their mind and tell you their opinions. You need to then explain to them about the importance of security over usability. This is so that they can understand from your point if view why it's necessary. You need to also make sure that the security measures put in place are user friendly. This is to avoid it from being a hastle for the users.

Meet with them, understand their requirements. Include other SMEs (E.g., Sys Admins, Network Admins, Security Engineers/Architects, Product Solutions Experts etc.). Discuss how they intend to achieve those requirements and collaboratively explore potential alternatives. Business Requirements product comparison should then take place, and a security review of the potential solutions should take place. With this, the Asset and Risk Owner of the Business Product/Process can make an informed decision as to which solution would make sense pursuing.

Minimize friction: Security measures should be intuitive and not disrupt workflows. Provide clear feedback: Users should understand why security measures exist and how to comply. Offer alternatives: If one method (e.g., complex passwords) is too burdensome, provide easier but still secure options (e.g., passkeys or multi-factor authentication).